Data retention - verified
Does xAI store your API prompts?
Default retention: 30 days, abuse auditing. Trains on your API data: No. Zero data retention: self-serve (team admins in the xAI Console, where available). Regional processing: US.
Read from docs.x.ai, x.ai. Compare every AI API's data retention
- Trains on data
- No
- ZDR
- Self-serve
- Regions
- US
- Verified
- 2026-10-18
How long are prompts kept by default?
- Default retention
30 days, abuse auditing
All API requests and responses stored (encrypted at rest) for 30 days for auditing in case of suspected abuse or misuse, then automatically deleted.
“By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days for auditing purposes in the event of suspected abuse or misuse. SpaceXSI does not train on this data, and it is automatically deleted after 30 days.”
docs.x.ai - Duration
- Not stated
- Purpose
- Not stated
Does it train on your API data?
No
No training on API inputs or outputs without explicit permission.
“SpaceXSI never trains on your API inputs or outputs without your explicit permission.”
“SpaceXSI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems or to develop any new products, services, or features, subject to disclosures to Customer and Customer-controlled user settings.”
Zero data retention (ZDR)
- Availability
Self-serve: you can switch it on yourself
Team admins in the xAI Console, where available
- Who can get it
Team-level, self-serve for team admins in the xAI Console where available; negotiated Enterprise agreements may govern retention separately.
- Not covered
Disables per-API-key request logging, stateful Responses API, Files API, Collections API, Batch API, deferred completions, stored image/video outputs, voice agent conversation history.
- From the docs
“No storage of prompts: ZDR ensures that API request inputs (i.e., your prompt) and outputs (i.e., the tokens generated by the LLM) are never persisted to disk. The 30-day audit retention described above does not apply to ZDR-enabled teams.”
docs.x.ai “Self-serve: Where available, a team admin can turn it on or off directly from the xAI Console. When enabled, it applies to every API key on the team.”
docs.x.ai “Any capability that relies on SpaceXSI storing data is unavailable while ZDR is enabled:”
docs.x.ai “Notwithstanding the foregoing, when and to the extent Customer elects to use ZDR, User Content will exist in SpaceXSI systems only transiently and solely to the extent required to generate and return the real-time response; SpaceXSI will delete all such User Content, including any transient storage or processing artifacts, upon the earlier of (a) one hour after completion of the applicable inference request; or (b) delivery of the response;”
x.ai
Features kept longer
Stateful features hold your content until a job finishes, a window expires or you delete it, often regardless of the default above.
| Feature | Retention | The docs say |
|---|---|---|
| Files, Collections, stateful Responses API, Batch, deferred completions, stored image/video outputs | Not stated | “Uploaded files are stored server-side, so under ZDR new uploads and `file_id` attachments are blocked.”docs.x.ai |
| Enterprise terms general deletion rule (with exceptions) | No later than 30 days after the interaction or session, unless otherwise agreed, legally required, or needed for safety/abuse investigation | “All User Content will be automatically and permanently deleted no later than 30 days after the end of the interaction or session in which it was submitted unless a different retention period is: (a) explicitly agreed in an Order Form, Documentation, or conspicuous notices within the Services or otherwise selected by Customer via self-service tools made available by SpaceXSI; (b) required by applicable law; or (c) reasonably necessary for safety, security, compliance, moderation, abuse prevention, or investigation of suspected violations of this Agreement”x.ai |
Where is your data stored and processed?
- Regional processing
US
US endpoint, 10% higher token price, selected models
- Stated location
Not guaranteed on the global endpoint
Recorded as: Global endpoint: not guaranteed; may route between regions.
- How to choose
- Not stated
- What it covers
US endpoint: both processing and storage of retained request data.
- Summary
Global endpoint api.x.ai has no guaranteed processing region. The US endpoint guarantees request handling, inference, moderation and storage of retained request data in the US; Files, Collections, server-side tools and the network path are outside the guarantee. Only grok-4.7 and grok-4.6, no image/video/voice APIs, 10% higher token price.
- From the docs
“https://api.x.ai is the global endpoint. SpaceXSI may route requests between regions for capacity or reliability, so the processing location is not guaranteed.”
docs.x.ai “The US guarantee covers API request handling, inference, moderation, and retained request data. It does not cover Files, Collections, server-side tools, or the network path from your systems to SpaceXSI.”
docs.x.ai “A regional endpoint is not, by itself, a comprehensive data-residency guarantee. If you have contractual requirements about where your data is processed or stored, contact sales@x.ai before relying on the US endpoint for compliance.”
docs.x.ai
Regional endpoints
- Global
api.x.ai“https://api.x.ai is the global endpoint.”
docs.x.ai - US
us.api.x.ai“If you need API request handling and model inference to happen in the United States, use the US regional endpoint, https://us.api.x.ai/v1. It is available to every team, and your existing API keys work on both endpoints.”
docs.x.ai
Certifications
- SOC 2 Type 2
“We are SOC 2 Type 2 compliant.”
Research notes
- Docs and legal pages now use the SpaceXSI name for xAI. ZDR applies on the US endpoint too. Every API response carries an x-zero-data-retention header. HIPAA BAA by questionnaire.
FAQ
Does xAI store your API prompts?
30 days, abuse auditing. All API requests and responses stored (encrypted at rest) for 30 days for auditing in case of suspected abuse or misuse, then automatically deleted. The provider says: "By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days for auditing purposes in the event of suspected abuse or misuse. SpaceXSI does not train on this data, and it is automatically deleted after 30 days."
Does xAI train on your API data?
No. The provider says: "SpaceXSI never trains on your API inputs or outputs without your explicit permission."
Does xAI offer zero data retention?
Self-serve (team admins in the xAI Console, where available). Team-level, self-serve for team admins in the xAI Console where available; negotiated Enterprise agreements may govern retention separately.
Where does xAI process your data?
Regional processing options: US (US endpoint, 10% higher token price, selected models). Stated processing location: Not guaranteed on the global endpoint.
Sources
Last verified from xAI's own pages below. Quotes are verbatim.
This page summarizes what each provider's own pages say. It is not legal advice; your contract, data processing addendum and the provider's current terms govern what happens to your data.
Newsletter
Know when a provider changes its data terms
One email per week. New model releases, pricing and policy changes, and what they mean for what you build.